dsh-custom-mode 1.1.0 → 1.3.0

package/client.js

@@ -92,6 +92,17 @@ try {
         "msg.reorderFailed": "调整顺序失败",
         "msg.imported": "已导入到编辑器（还没有保存）：检查后点「保存」。",
         "msg.importFailed": "导入失败",
+        "warn.personaOffWithPrompt": "「身份（系统提示词）」这一行是关的，所以 prompt.md 不会被注入 —— 你写的提示词现在不起作用。要么打开这一行，要么清空提示词。",
+        "warn.toolOff": "「custom_prompt 工具」这一行是关的：会话里无法让 agent 改提示词，只能在本页改。",
+        "warn.noDescription": "没有描述：新建会话的模式选择器里会显示成「暂无描述」。",
+        "warn.noName": "没有名字：模式选择器里会显示成目录 id（例如 custom）。",
+        "history.label": "改动历史",
+        "history.pick": "选择要载入的版本…",
+        "history.load": "载入这一版",
+        "history.hint": "每次保存、以及会话内工具或手工改动，都会在这里留一版；载入只改草稿，保存前不落盘。",
+        "history.by.settings": "设置页保存",
+        "history.by.external": "会话内/手工改动",
+        "msg.loadFailed": "载入这一版失败",
         "msg.importEmpty": "这个文件是空的。",
         "msg.importTooLarge": "文件太大（上限 1MB）。",
         "msg.exported": "已导出为文件。",
@@ -224,6 +235,17 @@ try {
         "msg.reorderFailed": "Could not reorder",
         "msg.imported": "Imported into the editor (not saved yet) — review it, then click Save.",
         "msg.importFailed": "Import failed",
+        "warn.personaOffWithPrompt": "The \"Identity (system prompt)\" row is off, so prompt.md is never injected — the prompt you wrote has no effect. Turn the row on, or clear the prompt.",
+        "warn.toolOff": "The \"custom_prompt tool\" row is off: the agent cannot change the prompt from inside a session, only this page can.",
+        "warn.noDescription": "No description: the new-session mode picker will show it as \"no description yet\".",
+        "warn.noName": "No name: the mode picker will show the directory id (e.g. custom).",
+        "history.label": "Change history",
+        "history.pick": "Pick a version to load…",
+        "history.load": "Load this version",
+        "history.hint": "Every save — plus changes made in a session or by hand — leaves a version here. Loading one only edits the draft; nothing is written until you save.",
+        "history.by.settings": "saved from this page",
+        "history.by.external": "changed in a session / by hand",
+        "msg.loadFailed": "Could not load that version",
         "msg.importEmpty": "That file is empty.",
         "msg.importTooLarge": "That file is too large (1 MB limit).",
         "msg.exported": "Exported to a file.",
@@ -535,6 +557,7 @@ try {
       const ROUTES = {
         list: ROUTE,
         state: ROUTE + "/state",
+        history: ROUTE + "/history",
         create: ROUTE + "/create",
         delete: ROUTE + "/delete",
         reorder: ROUTE + "/reorder",
@@ -576,6 +599,13 @@ try {
       }
 
       /** The editable draft for one assistant, derived from its loaded state. */
+      /** 时间戳给人看：转本地时间；解析不了就原样显示（历史文件是纯文本，什么都有可能）。 */
+      function formatWhen(at) {
+        const parsed = new Date(at)
+        if (Number.isNaN(parsed.getTime())) return String(at).slice(0, 16)
+        return parsed.toLocaleString()
+      }
+
       function draftOf(state) {
         return {
           id: state.id,
@@ -587,6 +617,11 @@ try {
           // 「恢复出厂提示词」要用它。它不是草稿的一部分，`sameDraft` 不比较它 ——
           // 漏掉这一行按钮会一直置灰（实测：真点了没反应，浏览器验收抓到）。
           factoryPrompt: typeof state.factoryPrompt === "string" ? state.factoryPrompt : null,
+          // 改动历史：列表来自 state（只有元数据），正文点「载入这一版」时按需取。
+          history: Array.isArray(state.history) ? state.history : [],
+          historyPick: "",
+          // 「配置了却不生效」的告警码；文案按当前语言渲染。
+          warnings: Array.isArray(state.warnings) ? state.warnings : [],
         }
       }
 
@@ -915,6 +950,24 @@ try {
           update({ prompt: factory })
         }
 
+        /** 把某个历史版本载入编辑器。与「恢复出厂」同一条纪律：只改草稿，保存前不落盘。 */
+        const loadVersion = async () => {
+          const picked = typeof draft.historyPick === "string" ? draft.historyPick : ""
+          if (picked === "" || draft.id === undefined) return
+          try {
+            // 版本键是序号（时间戳会在同一毫秒内撞车 —— 单测就是那样抓到它的）。
+            const response = await fetch(ROUTES.history + "?id=" + encodeURIComponent(draft.id) + "&n=" + encodeURIComponent(picked))
+            const payload = await asJson(response)
+            if (payload === null || payload.ok !== true) {
+              setStatus(t("msg.loadFailed"))
+              return
+            }
+            update({ prompt: payload.text })
+          } catch (error) {
+            setStatus(t("msg.loadFailed") + "：" + describeError(error))
+          }
+        }
+
         const exportPrompt = () => {
           try {
             const blob = new Blob([draft.prompt], { type: "text/markdown;charset=utf-8" })
@@ -1314,6 +1367,42 @@ try {
                   "aria-label": t("prompt.heading"),
                   onChange: (event) => update({ prompt: event.target.value }),
                 }),
+                // 改动历史：谁在什么时候改过。之前这里只有"当前文本"，所以会话内的工具
+                // （或手工编辑）改掉提示词时，用户既看不见也回不去。
+                draft.history.length === 0
+                  ? null
+                  : react.createElement(
+                      "div",
+                      { className: "cpfe-history" },
+                      react.createElement("span", { className: "cpfe-history-label" }, t("history.label")),
+                      react.createElement(
+                        "select",
+                        {
+                          value: draft.historyPick,
+                          "aria-label": t("history.label"),
+                          onChange: (event) => update({ historyPick: event.target.value }),
+                        },
+                        react.createElement("option", { value: "" }, t("history.pick")),
+                        ...draft.history.map((entry) =>
+                          react.createElement(
+                            "option",
+                            { key: String(entry.n), value: String(entry.n) },
+                            formatWhen(entry.at) + " · " + t("history.by." + entry.by) + " · " + String(entry.bytes) + " B",
+                          ),
+                        ),
+                      ),
+                      react.createElement(
+                        A.Button,
+                        {
+                          variant: "outline",
+                          size: "sm",
+                          disabled: busy || draft.historyPick === "",
+                          onClick: loadVersion,
+                        },
+                        t("history.load"),
+                      ),
+                      react.createElement("span", { className: "cpfe-history-hint" }, t("history.hint")),
+                    ),
               ),
             ]
           : []
@@ -1323,6 +1412,18 @@ try {
           { className: "cpfe" },
           assistantList,
           react.createElement("p", { className: "cpfe-note" }, t("assistant.switchHint")),
+          // 配了却不生效的项：主动点名，而不是让用户对着"我明明写了"发呆。
+          // `draft` 在没选中任何助手时是 null（列表还没加载完 / 一个都没有）—— 这里必须先守卫，
+          // 否则整块设置页崩掉（实测：浏览器验收当场报 Cannot read properties of null）。
+          draft === null || draft.warnings === undefined || draft.warnings.length === 0
+            ? null
+            : react.createElement(
+                "div",
+                { className: "cpfe-warns" },
+                ...draft.warnings.map((code) =>
+                  react.createElement("p", { key: code, className: "cpfe-warn" }, "⚠ " + t("warn." + code)),
+                ),
+              ),
           ...editorSections,
           react.createElement(
             "div",

package/index.mjs

@@ -51,6 +51,7 @@ import {
   setShippedPresetsDir,
 } from './composition.mjs'
 import { readPresetMeta, writePresetMeta, presetMetaPath, PRESET_META_PATH } from './meta.mjs'
+import { listHistory, readVersion, recordExternalChange, recordPrompt, HISTORY_SOURCE } from './journal.mjs'
 import { packagedPresetDir } from './seed.mjs'
 import {
   allocateId,
@@ -70,11 +71,13 @@ const STATE_PATH = ROUTE_PATH + '/state'
 const CREATE_PATH = ROUTE_PATH + '/create'
 const DELETE_PATH = ROUTE_PATH + '/delete'
 const REORDER_PATH = ROUTE_PATH + '/reorder'
+const HISTORY_PATH = ROUTE_PATH + '/history'
 
 /** Which verbs each endpoint answers. `undefined` for a path means 404. */
 const METHODS = {
   [ROUTE_PATH]: ['GET'],
   [STATE_PATH]: ['GET', 'POST'],
+  [HISTORY_PATH]: ['GET'],
   [CREATE_PATH]: ['POST'],
   [DELETE_PATH]: ['POST'],
   [REORDER_PATH]: ['POST'],
@@ -208,6 +211,37 @@ function packagedPrompt() {
   return packagedPromptCache
 }
 
+/**
+ * 「配置了，但不生效」的告警码。
+ *
+ * 这一条借自同生态的 whale-persona：它会主动点名"配了却没起作用"的项。这里对应四种**静默**的
+ * 自相矛盾 —— 每一种此前都只会让人以为"我明明写了提示词/描述，怎么没效果"：
+ *
+ *   - `personaOffWithPrompt`：身份行被关掉，`prompt.md` 根本不会被注入（最坑的一种）；
+ *   - `toolOff`：`custom_prompt` 工具行关掉 → 会话内改提示词不可用（设置页照旧）；
+ *   - `noDescription`：描述为空 → 新建会话的模式选择器里显示「暂无描述」；
+ *   - `noName`：名字为空 → 选择器里显示成裸目录 id。
+ *
+ * 只返回**码**，文案由页面按语言渲染（双语文案的真值源在 locales.mjs 一处）。
+ *
+ * @param {string} text - the composition text.
+ * @param {string} prompt - the prompt file's content.
+ * @param {{name?: string, description?: string}} meta - `preset.yml`.
+ * @returns {string[]} warning codes, stable order.
+ */
+export function configWarnings(text, prompt, meta) {
+  const warnings = []
+  const rows = collectRows(text)
+  const find = (id) => rows.find((row) => row.id === id)
+  if (find('persona')?.disabled === true && typeof prompt === 'string' && prompt.trim() !== '') {
+    warnings.push('personaOffWithPrompt')
+  }
+  if (find('custom-prompt-tool')?.disabled === true) warnings.push('toolOff')
+  if (typeof meta?.description !== 'string' || meta.description.trim() === '') warnings.push('noDescription')
+  if (typeof meta?.name !== 'string' || meta.name.trim() === '') warnings.push('noName')
+  return warnings
+}
+
 export function readState(rows, id, options = {}) {
   const directory = assistantDir(rows, id)
   if (directory === undefined) return unknownAssistant(id)
@@ -217,6 +251,9 @@ export function readState(rows, id, options = {}) {
   const mode = modeOf(text)
   const prompt = readPrompt(directory)
   const meta = readPresetMeta(directory)
+  // 页面要打开时顺便对账：磁盘上的文本若与日志末条不同，说明它在设置页之外被改过
+  // （会话内的 custom_prompt 工具、手工编辑、别处同步）—— 补记一条 external，于是"被改过"看得见。
+  if (prompt.ok === true) recordExternalChange(directory, prompt.text)
   return {
     ok: true,
     id,
@@ -234,6 +271,10 @@ export function readState(rows, id, options = {}) {
     // 回退用的出厂文本。它不是"当前值"，页面只把它填进编辑器，保存前不落盘 —— 所以
     // 一次误点不会破坏任何东西（重新读取即可丢弃）。
     factoryPrompt: typeof options.factoryPrompt === 'string' ? options.factoryPrompt : null,
+    // 改动历史（只有元数据，正文按需取：见 GET /custom-mode/history）。
+    history: listHistory(directory),
+    // 「配置了却不生效」的告警码（文案在页面侧按语言渲染）。
+    warnings: configWarnings(text, prompt.ok === true ? prompt.text : '', meta),
   }
 }
 
@@ -311,6 +352,9 @@ export function saveState(rows, input) {
   try {
     writeAtomic(compositionFile(directory), composition)
     writeAtomic(promptFile(directory), prompt)
+    // 改动留痕：三个改动路径（设置页 / 会话内工具 / 手工编辑）里，只有设置页是"当场知道"的。
+    // 另外两条由 readState 对比补记（见 journal.mjs 的单写者说明）。
+    recordPrompt(directory, prompt, HISTORY_SOURCE.settings)
   } catch (error) {
     return { ok: false, error: '写入失败：' + describe(error) }
   }
@@ -601,6 +645,16 @@ export function apply(ctx) {
           return json(readState(await roster(), url.searchParams.get('id') ?? '', { factoryPrompt: packagedPrompt() }))
         }
 
+        if (request.method === 'GET' && pathname === HISTORY_PATH) {
+          await ensureShipped()
+          const id = url.searchParams.get('id') ?? ''
+          const directory = assistantDir(await roster(), id)
+          if (directory === undefined) return json(unknownAssistant(id), 404)
+          const text = readVersion(directory, url.searchParams.get('n') ?? '')
+          if (text === null) return json({ ok: false, error: '找不到这个版本（历史可能已被上限裁剪）。' }, 404)
+          return json({ ok: true, id, n: url.searchParams.get('n'), text })
+        }
+
         // Backstop on request size. `requestBody: 'buffered'` means the platform applies its own
         // JSON cap, but that cap is the host's configuration, not a contract — measured on Windows,
         // a 5 MB body reached us happily. This keeps one authenticated request from making us buffer

package/journal.mjs

@@ -0,0 +1,157 @@
+/**
+ * 提示词改动日志：**只追加**、单写者、可审计。
+ *
+ * 为什么需要它：一个助手的 `prompt.md` 有三条改动路径 —— 设置页保存、会话内的 `custom_prompt`
+ * 工具、以及手工编辑文件。后两条对用户是**不可见**的：提示词变了，页面只会显示"当前文本"，
+ * 没有任何地方能看出"谁在什么时候改的、上一版是什么"。这个模块把每一次变化留成一行，于是
+ * "恢复出厂"之外还能"回到上一版"，会话内被改动也能被看见。
+ *
+ * 设计取舍（都写在这里，因为它们看起来可以更简单）：
+ *
+ * 1. **单写者**：只有宿主半写这个文件。会话内的工具**不**直接写日志 —— 否则文件格式就得在
+ *    preset 副本里再实现一遍（那些文件是独立分发的）。改为在读状态时对比"当前文本 vs 日志末条"，
+ *    不一致就补记一条 `external`：工具改的、手工改的、甚至别的机器同步过来的，都会以同一种方式
+ *    留痕。代价是同一段文本的**中间若干次**改动看不到（我们只能看到"离开时的样子"），这一点
+ *    在文档里写明，不假装是版本控制。
+ * 2. **只追加 + 上限**：追加而不是覆盖，坏一行不牵连其余（解析时跳过坏行）。超过上限就整文件
+ *    重写成最后 N 条 —— 这是唯一的"重写"，且只发生在追加之后，用原子写完成。
+ * 3. **相同内容不重复记**：保存两次而文本没变，不该产生两条历史。
+ * 4. **版本键是自增序号，不是时间戳**：同一毫秒内落两次记录完全可能（实测：连续两次保存），
+ *    时间戳做键会让"取回某一版"取到隔壁那条。时间戳只用于显示。
+ *
+ * 这个方向借鉴了同生态里 whale-persona 的"收件箱"设计（只追加、坏行不牵连、状态显式），
+ * 但这里记录的是**已发生的事实**而不是待确认的提议 —— 我们的场景是"改了什么要看得见、回得去"，
+ * 不需要它的确认闸门。
+ */
+import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+/** 每个助手目录下的日志文件名。 */
+export const HISTORY_NAME = 'prompt-history.jsonl'
+
+/** 保留的最大版本数。超出后整文件重写为最后这么多条。 */
+export const HISTORY_MAX = 30
+
+/** 改动来源。`settings` 是设置页保存；`external` 是日志末条之后发生的任何改动。 */
+export const HISTORY_SOURCE = { settings: 'settings', external: 'external' }
+
+/** @param {string} directory - one assistant's preset directory. */
+export function historyFile(directory) {
+  return join(directory, HISTORY_NAME)
+}
+
+/**
+ * Parse the log, skipping unreadable lines.
+ *
+ * A line that is not valid JSON, or lacks a text, is ignored rather than throwing: this file is
+ * written across process restarts and may be edited by hand, and one bad line must not cost the
+ * user every version (the same reason the inbox design in this ecosystem replays line by line).
+ *
+ * @returns {Array<{ at: string, by: string, text: string }>} oldest first.
+ */
+export function readEntries(directory) {
+  const file = historyFile(directory)
+  if (!existsSync(file)) return []
+  const entries = []
+  for (const line of readFileSync(file, 'utf8').split('\n')) {
+    if (line.trim() === '') continue
+    try {
+      const parsed = JSON.parse(line)
+      if (parsed === null || typeof parsed !== 'object') continue
+      if (typeof parsed.text !== 'string') continue
+      entries.push({
+        // 老日志没有 n 时按行序补一个，于是"序号"这个概念对任何日志都成立。
+        n: Number.isInteger(parsed.n) && parsed.n > 0 ? parsed.n : entries.length + 1,
+        at: typeof parsed.at === 'string' ? parsed.at : '',
+        by: typeof parsed.by === 'string' ? parsed.by : HISTORY_SOURCE.external,
+        text: parsed.text,
+      })
+    } catch {
+      continue
+    }
+  }
+  return entries
+}
+
+/**
+ * Append one revision, unless it repeats the newest one.
+ *
+ * @param {string} directory - one assistant's preset directory.
+ * @param {string} text - the prompt content **after** the change.
+ * @param {string} by - {@link HISTORY_SOURCE}.
+ * @returns {{ recorded: boolean, at: string, n: number }} whether a line was appended.
+ */
+export function recordPrompt(directory, text, by = HISTORY_SOURCE.settings) {
+  if (typeof text !== 'string') return { recorded: false, at: '' }
+  const entries = readEntries(directory)
+  const newest = entries[entries.length - 1]
+  if (newest !== undefined && newest.text === text) return { recorded: false, at: newest.at }
+
+  const at = new Date().toISOString()
+  const n = entries.length === 0 ? 1 : entries[entries.length - 1].n + 1
+  const lines = entries.slice(-(HISTORY_MAX - 1)).map((entry) =>
+    JSON.stringify({ n: entry.n, at: entry.at, by: entry.by, bytes: entry.text.length, text: entry.text }),
+  )
+  lines.push(JSON.stringify({ n, at, by, bytes: text.length, text }))
+
+  // 唯一的整文件重写：顺手把上限外的旧条目丢掉，用原子写落盘（读取器不会看到写了一半的文件）。
+  const file = historyFile(directory)
+  const temporary = `${file}.tmp-${String(process.pid)}`
+  writeFileSync(temporary, lines.join('\n') + '\n', 'utf8')
+  renameSync(temporary, file)
+  return { recorded: true, at, n }
+}
+
+/**
+ * The log as the page needs it: newest first, **without** the texts.
+ *
+ * Text is fetched per revision on demand (`readVersion`) — a page that ships 30 prompts on every
+ * load would be slower than the thing it is documenting.
+ *
+ * @returns {Array<{ at: string, by: string, bytes: number, preview: string }>}
+ */
+export function listHistory(directory, limit = HISTORY_MAX) {
+  const entries = readEntries(directory)
+  const out = []
+  for (const entry of entries.slice(-limit).reverse()) {
+    const firstLine = entry.text.split('\n').find((line) => line.trim() !== '') ?? ''
+    out.push({
+      n: entry.n,
+      at: entry.at,
+      by: entry.by,
+      bytes: entry.text.length,
+      preview: firstLine.trim().slice(0, 80),
+    })
+  }
+  return out
+}
+
+/**
+ * One revision's full text, by its sequence number.
+ *
+ * The key is `n`, not `at`: two revisions can share a timestamp (measured — two records inside the
+ * same millisecond), and keying on it silently returns the neighbour.
+ *
+ * @param {number|string} n - the revision number shown in {@link listHistory}.
+ * @returns {string|null}
+ */
+export function readVersion(directory, n) {
+  const wanted = typeof n === 'string' ? Number(n) : n
+  if (!Number.isInteger(wanted)) return null
+  for (const entry of readEntries(directory)) {
+    if (entry.n === wanted) return entry.text
+  }
+  return null
+}
+
+/**
+ * Record `text` as an `external` revision when it is not what the log already ends with.
+ *
+ * This is how changes made outside the settings page become visible: the page asks for state, and
+ * the host notices that what is on disk is not what it last recorded.
+ *
+ * @returns {boolean} whether something was recorded.
+ */
+export function recordExternalChange(directory, text) {
+  return recordPrompt(directory, text, HISTORY_SOURCE.external).recorded
+}

package/locales.mjs

@@ -52,6 +52,17 @@ export const zh = {
   'msg.reorderFailed': '调整顺序失败',
   'msg.imported': '已导入到编辑器（还没有保存）：检查后点「保存」。',
   'msg.importFailed': '导入失败',
+  'warn.personaOffWithPrompt': '「身份（系统提示词）」这一行是关的，所以 prompt.md 不会被注入 —— 你写的提示词现在不起作用。要么打开这一行，要么清空提示词。',
+  'warn.toolOff': '「custom_prompt 工具」这一行是关的：会话里无法让 agent 改提示词，只能在本页改。',
+  'warn.noDescription': '没有描述：新建会话的模式选择器里会显示成「暂无描述」。',
+  'warn.noName': '没有名字：模式选择器里会显示成目录 id（例如 custom）。',
+  'history.label': '改动历史',
+  'history.pick': '选择要载入的版本…',
+  'history.load': '载入这一版',
+  'history.hint': '每次保存、以及会话内工具或手工改动，都会在这里留一版；载入只改草稿，保存前不落盘。',
+  'history.by.settings': '设置页保存',
+  'history.by.external': '会话内/手工改动',
+  'msg.loadFailed': '载入这一版失败',
   'msg.importEmpty': '这个文件是空的。',
   'msg.importTooLarge': '文件太大（上限 1MB）。',
   'msg.exported': '已导出为文件。',
@@ -201,6 +212,17 @@ export const en = {
   'msg.reorderFailed': 'Could not reorder',
   'msg.imported': 'Imported into the editor (not saved yet) — review it, then click Save.',
   'msg.importFailed': 'Import failed',
+  'warn.personaOffWithPrompt': 'The "Identity (system prompt)" row is off, so prompt.md is never injected — the prompt you wrote has no effect. Turn the row on, or clear the prompt.',
+  'warn.toolOff': 'The "custom_prompt tool" row is off: the agent cannot change the prompt from inside a session, only this page can.',
+  'warn.noDescription': 'No description: the new-session mode picker will show it as "no description yet".',
+  'warn.noName': 'No name: the mode picker will show the directory id (e.g. custom).',
+  'history.label': 'Change history',
+  'history.pick': 'Pick a version to load…',
+  'history.load': 'Load this version',
+  'history.hint': 'Every save — plus changes made in a session or by hand — leaves a version here. Loading one only edits the draft; nothing is written until you save.',
+  'history.by.settings': 'saved from this page',
+  'history.by.external': 'changed in a session / by hand',
+  'msg.loadFailed': 'Could not load that version',
   'msg.importEmpty': 'That file is empty.',
   'msg.importTooLarge': 'That file is too large (1 MB limit).',
   'msg.exported': 'Exported to a file.',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-custom-mode",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "Custom modes and custom prompts for DeepSeek Harness (dsh): edit a mode's system prompt on the settings page (it takes effect on the next model step), choose its base mode, switch plugins row by row, and keep several assistants side by side.",
   "license": "MIT",
   "type": "module",
@@ -52,6 +52,7 @@
     "meta.mjs",
     "paths.mjs",
     "locales.mjs",
+    "journal.mjs",
     "cordis.patch.yml",
     "preset/"
   ],

package/preset/prompt-tool.mjs

@@ -40,6 +40,7 @@ const META_PATH = fileURLToPath(new URL('./preset.yml', import.meta.url))
 const MISSING = '（prompt.md 不存在，当前模式会退回上一次成功的提示词文本）'
 
 /** Name used when neither the composition nor `preset.yml` supplies one. */
+const TOOL_NAME = 'custom_prompt'
 const FALLBACK_MODE_NAME = '自定义模式'
 
 /**
@@ -201,12 +202,67 @@ function makeDefinition(modeName) {
   }
 }
 
+/**
+ * 自我改提示词的审批闸门。
+ *
+ * `action: "write"` 会**覆盖整个系统提示词**，而调用它的可能是模型自己 —— 一次提示词注入就足以
+ * 让它重写自己的身份。此前这条路径没有任何门：工具直接落盘。
+ *
+ * 现在它走平台的审批缝：`tools/pre-execute` 是一个 waterfall，返回 `{kind:'ask'}` 会由审批策略决定
+ * 怎么处理。**实测（0.1.6-alpha.2，一次性实例）**：
+ *
+ *   - 审批策略为 `ask`（权限预设 `workspace-write`）：页面出现「等待审批」行，带这里的 reason，
+ *     按钮为「拒绝 / 允许一次」；点「允许一次」后工具真的执行，prompt.md 变成写入的内容；
+ *   - 审批策略为 `never`（权限预设 `danger-full-access`）：**不弹窗，直接判为拒绝**
+ *     （轨迹里是 `Error: the user rejected tool "custom_prompt"`，文件未被修改）。
+ *
+ * 也就是说这条闸门**最坏情况是"改不成"而不是"悄悄改成了"** —— 与平台的默认语义一致
+ * （类型注释原话：missing approval support turns `ask` into denial）。
+ *
+ * 只拦 `write`：`read` 不改变任何东西，弹窗只会让人麻木。
+ *
+ * @param {object} ctx - the preset row's scope.
+ * @returns {boolean} whether a gate was registered.
+ */
+function registerApprovalGate(ctx) {
+  if (typeof ctx.on !== 'function') return false
+  ctx.effect(
+    () => ctx.on('tools/pre-execute', (exec, next) => {
+      if (exec === null || typeof exec !== 'object' || exec.name !== TOOL_NAME) return next()
+      const args = exec.arguments
+      const action = args !== null && typeof args === 'object' ? args.action : undefined
+      // 只拦写入；未指定 action 时工具按 read 处理，同样不拦。
+      if (action !== 'write') return next()
+      const text = typeof args.text === 'string' ? args.text : ''
+      const firstLine = text.split('\n').find((line) => line.trim() !== '') ?? ''
+      return {
+        kind: 'ask',
+        reason:
+          '把「' + resolveModeName(undefined) + '」的系统提示词整体替换为 ' + String(text.length) + ' 字符' +
+          (firstLine === '' ? '' : '：' + firstLine.trim().slice(0, 60)) +
+          '（写入 ' + PROMPT_PATH + '）',
+      }
+    }),
+    'custom-prompt.approval-gate',
+  )
+  return true
+}
+
 /** The tool registry is a hard dependency; without it there is no tool. */
 export const inject = ['tools']
 
 export function apply(ctx, config = {}) {
   const definition = makeDefinition(resolveModeName(config))
   ctx.effect(() => ctx.tools.register(definition), 'custom-prompt.tool')
+
+  // 审批闸门。宿主若不支持 `tools/pre-execute`（比本插件声明的下限还老的构建），这里会**明确**
+  // 说一声再继续 —— 降级是有的，但不许静默。
+  if (registerApprovalGate(ctx) !== true) {
+    console.error(
+      'custom-mode: 这个宿主没有 tools/pre-execute 事件，会话内改写系统提示词的审批闸门**未启用**' +
+        '（设置页不受影响）。请升级 DSH，或把「custom_prompt 工具」这一行关掉。',
+    )
+  }
 }
 
 /**